Cookie Policy

This policy explains how Caremacy uses cookies and similar technologies on our website.

What are cookies?

Cookies are small text files that websites place on your device (computer, phone, or tablet) when you visit them. They help websites work properly and can remember your preferences.

Types of cookies we use

Strictly necessary cookies

These cookies are essential for our website to work. Without them, you wouldn't be able to use basic features like logging in or completing a consultation.

Examples:

• Session cookies that keep you logged in
• Security cookies (like CSRF tokens) that protect against attacks
• Cookies that remember your cookie preferences

You cannot opt out of these cookies because they are necessary for the website to function.

Analytics cookies

With your permission, PostHog cookies and similar browser storage help us understand how people use our public website so we can improve it. Automatic capture is disabled and we do not attach your Caremacy account identity to browser analytics.

What we collect:

• Allowlisted interactions on public pages
• How you arrived at our website
• General information about your device and browser

What we don't collect:

• Your name, email address or Caremacy account identifier
• Your consultation answers, condition, medicine or prescription
• Activity in consultation, patient, staff or authentication areas

Analytics consent is optional and separate from advertising attribution. Rejecting it does not affect the service or your care.

Advertising-attribution cookies

With your separate permission, Caremacy uses a first-party attribution cookie to measure which campaigns lead to submitted consultations and fulfilled care. The cookie contains only a random, opaque value. It is HttpOnly, so website scripts cannot read it, and expires after 95 days.

The associated first-party record may contain:

• Campaign parameters such as source, medium and campaign
• The referring website host
• Advertising click identifiers, encrypted at rest

We exclude consultation, patient, staff and authentication routes from browser capture. We do not put consultation answers, conditions, medicines, prescriptions or Caremacy patient/order identifiers into advertising-platform payloads.

Connecting a campaign with a submitted consultation or fulfilled supply may itself reveal that someone used a healthcare service. We treat that limited internal link as special-category health data and create it only with your separate explicit consent. You can withdraw that consent at any time through Cookie settings without affecting your care.

Google and Meta offline/lifecycle conversion exports are currently disabled. We will not enable an external export without documented policy and legal approval and an updated privacy assessment. Attribution consent does not mean consent to receive marketing emails or text messages.

How to manage cookies

Through our cookie banner

When you first visit our website, you'll see a cookie banner. You can:

• Accept analytics cookies only
• Reject non-essential cookies
• Manage your preferences in detail and separately give explicit consent for advertising attribution

You can change your preferences at any time by clicking the cookie settings link in our website footer.

Through your browser

Most browsers let you control cookies through their settings. You can:

• See what cookies are stored on your device
• Delete cookies
• Block cookies from certain websites
• Block all cookies

Note: Blocking all cookies may prevent our website from working properly.

Here's how to manage cookies in common browsers:

• Chrome: Settings → Privacy and security → Cookies
• Firefox: Settings → Privacy & Security → Cookies
• Safari: Preferences → Privacy
• Edge: Settings → Cookies and site permissions

Cookie and storage providers

The following providers may use cookies or similar browser storage:

The Caremacy consent-preference cookie is kept for one year. The optional attribution cookie and its raw first-party touch record are kept for up to 95 days, or deleted sooner when you withdraw consent. Browser analytics storage is removed when you withdraw analytics consent, subject to normal deletion propagation.

If a consented campaign is linked to a consultation, the minimal patient-linked campaign and lifecycle fields are kept for up to 400 days so we can measure mature refill retention and 90-day contribution. The campaign fields are then automatically removed. Withdrawal removes them sooner.

More information

For more details about how we handle your personal data, please see our Privacy Notice.

Changes to this policy

We may update this cookie policy from time to time. The "last updated" date at the top shows when it was last changed.

See also: Privacy Notice | Terms of Use